Windows Downdate:
Downgrade Attacks
Using Windows Updates

Alon Leviev
Security Researcher @ SafeBreach22-years-oldSelf-taught

OS internals, reverse engineering andvulnerability research
Former BJJ world and european champion
Creator of PoolParty process injection techniques

AgendaResearch Background

Downgrade Attacks Using Windows Updates
Virtualization-Based Security Vulnerabilities

Windows Update Restoration Vulnerability
Closing Remarks

W I N D O W S D O W N D AT E

ResearchBackgroundWhat are Downgrade Attacks?
Downgrade immune
software to vulnerable
softwareAttacker

Vulnerable
Software

ImmuneSoftwareDowngrade Attacks In-The-Wild –BlackLotus UEFI Bootkit
The BlackLotus UEFI bootkit employed a downgrade
attack to bypass Secure Boot

The Secure Boot bypass worked on fully updated
Windows 11 machines
Caused a massive panic in the cybersecurity industry

Secure Boot In a Nutshell
UEFI
FirmwareVerifyUEFI Boot
Manager

VerifyEach component in theboot chain must bedigitally signed

Windows
Boot Manager

VerifyWindows
Boot Loader

VerifyWindows KernelBlackLotus Secure Boot Bypass
UEFIFirmware

VerifyBlackLotus downgraded the Windows
Boot Manager to signed but vulnerable
version of it

UEFI Boot
Manager

VerifyWindows
Boot Manager

VerifyWindows
Boot Loader

VerifyWindows Kernel

Microsoft’s Mitigation Against
Secure Boot Downgrades
Microsoft’s mitigation included
adding signed but vulnerable boot managers torevocation lists

UEFI
FirmwareVerifyRevocation List…

Revoked boot managers are not allowed

UEFI Boot
Manager

VerifyWindows
Boot Manager

VerifyWindows
Boot Loader…
…

VerifyWindows KernelResearch Motivation

Are there any components affectedby downgrade attacks other thenSecure Boot?

Research Goals
Evaluate the state ofdowngrade attacks on Windows

Find if any other criticalcomponents have been overlookedDowngrade Vision
Bring Your Own
Vulnerable Windows!

What makes a downgrade attack complete?
Fully Undetectable The downgrade is performed in a legitimate way
Invisible

The downgraded components appear up to date

Persistent

Future updates do not overwrite the downgraded
components

Irreversible

Scanning and repairing tools are unable to detect
and repair corruptions

Finding the suitable component

Which component is theleast expected to perform
downgrades?

Finding the suitable component

Windows Updates!

W I N D O W S D O W N D AT E

Downgrade Attacks
Using Windows
UpdatesWindows Updates Architecture
Trusted Installer
Enforcement

Administrator
Enforcement

Update ClientProcess

Communication Over COM

Update Files

Ntoskrnl.exe

Ntdll.dll…

…

Update ServerProcessTrusted Installer enforcement –Is It Useful?
Multiple working public PoC’s of Administrator to Trusted Installer
elevation
It is considered malicious and EDRs detect such elevations
Even if I bypass detection, self-implementing the downgrade may
seem malicious
Taking over the Windows Update process solves
all of that

Update Flow
1. Client asks the server to perform anupdate given an update folder

Update Client
Process

Update Server
Process
UpdateFolderUpdate Flow
2. Server validates the integrityof the client supplied update folder

Update Client
Process

Update Server
Process

UpdateFolderUpdate Flow
3. Server operates on the update folder
to finalize the update files

Update Client
Process

Update Server
Process
Update Files
UpdateFolderUpdate Flow
4. Server saves the update action list to%WinDir%\WinSxS\Pending.xml

Update Client
Process

Update Server
Process
Update Files
UpdateFolderUpdate Flow
Update Client
Process

5. In the next reboot, Pending.xml
is operated on, and the update actions
are performed

Update Server
Process

Update Files
UpdateFolder

What Is Client Controlled?
Update Client
Process

Update Server
Process
Update Files
UpdateFolderTrusted Installer Enforced
Trusted Installer Enforced

ClientControlledUpdate Folder Contents
Update Component

Update folder contains
update components

UpdateFolder

Update Folder Contents – MUM
Update Component

MUM files containcomponent metadata,
component
dependencies,
installation order etc.

UpdateFolder

Update Folder Contents – Manifest
Update Component

Manifest files containinstallation specific datasuch as file paths,registry keys, andinstallers to execute

UpdateFolderUpdate Folder Contents – Differential
Update Component

Differential files
are deltas from the basefiles
Base + Differential = Full
Update File

UpdateFolderUpdate Folder Contents – Catalog
Update Component

Catalog files are
the digital signatures ofMUM and Manifest
files

UpdateFolderUpdate Folder Contents – Recap
Only Catalogs are explicitly digitally signed

Manifests and MUMs are not explicitly digitally signed, butare signed in Catalogs
Differentials are not digitally signed
Differentials control the actual final update file content

Targeting Differential Files
Any chance that differential files
were left behind interms of verification?

Targeting Differential Files – Impossible
Expected full update files
hashes are hardcoded in themanifests

Sha256(Full Update File)Targeting The Action List
The action list is Trusted Installer enforced.
Since operated on during reboots, thesystem must save its state somewhere.

Targeting The Action List – Possible!
Action List path is saved in the registry and is
not Trusted Installer enforced!

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\Configuration\PoqexecCmdline

PoqExec.exe Pending.xml [more args]

What Can We Do With The Action List?
<POQ postAction="reboot"><CreateFile path="C:\Windows\System32\Create.exe" fileAttributes="0x00000000"/><MoveFile source="C:\UpdateDir\Source.exe“ destination="C:\Windows\System32\Destination.exe"/><HardlinkFile source="C:\UpdateDir\Source.exe“ destination="C:\Windows\System32\Destination.exe"/><SetFileInformation path="C:\UpdateDir\Source.exe“ securityDescriptor="binary base64:[BASE64-BLOB]" flags="0x00000040"/><DeleteFile path="C:\Windows\System32\Delete.exe"/><CreateDirectory path="C:\Windows\System32\Directory" fileAttribute="0x00000080“ securityDescriptor="binary base64:[BASE64-BLOB]"/><CreateKey path="\Registry\Machine\Key"/><SetKeyValue path="\Registry\Machine\Key" name="Name" type="0x00000001“ encoding="base64" value="[BASE64-BLOB]"/><SetKeySecurity path="\Registry\Machine\Key“ securityDescriptor="binary base64:[BASE64-BLOB]" flags="0x00000001"/><DeleteKeyValue path="\Registry\Machine\Key" name="Value"/><DeleteKey flags="0x00000001" path="\Regsitry\Machine\Key"/></POQ>

How To Downgrade Files?
The HardlinkFile action can be used to downgrade system files<HardlinkFile source="C:\UpdateDir\Source.exe“ destination="C:\Windows\System32\Destination.exe"/>

Initiating Update
1. Set Trusted Installer service as Auto-Start

TrustedInstaller Service

2. Add Pending.xml path in registry
HKLM\.....\PoqexecCmdline

3. Add Pending.xml identifier in registry

HKLM\COMPONENTS\PendingXmlIdentifierDowngrade Attack via Windows Update Achieved!
Ability to “update” the system with a downgradingPending.xml
All integrity verification checks are bypassed

No Trusted Installer elevation is required
Complete Windows Update takeover!

Complete Downgrade Attack – Fully Undetectable

The downgrade is fully undetectable, it isperformed
in the most legitimate way

Complete Downgrade Attack – Invisible

The system will appear up to date, as we“updated” the system

Complete Downgrade Attack – Persistent
The action list parser PoqExec.exe is not digitally signed, and canbe patched to install empty updates…

Not installing
updates
PoqExec.exe

Complete Downgrade Attack – Irreversible
The System Integrity Check and Repair utility SFC.exe is notdigitally signed, and can be patched to never detect or repair
corruptions

Not detecting or repairing
corruptions
SFC.exeDemo #1

Admin to Kernel – Security Boundary?
Not a security
boundary
Administrator

KernelAdmin to Kernel – Not a Boundary, But Still a Threat
Lots of users are still running
as Administrator

Microsoft’s Solution –Deprivileging the Kernel

Microsoft decided to deprivilege
the kernel to make kernel accessless valuable

W I N D O W S D O W N D AT E

VirtualizationBased Security

What Is VBS?
Secure and isolated virtual environment
powered by the Hyper-V hypervisor

Why VBS was created?

Kernel is assumed compromised
Need a secure place for security features andkey storage

VBS Security Features
Credential Guard

Hypervisor-Protected Code Integrity (aka. HVCI)
System Guard Secure Launch
Shielded VMs

And more!

Windows Architecture – Before VBS

User Mode(Ring 3)

Kernel Mode
(Ring 0)Hypervisor(Ring -1)

Process A

Process B

KernelHypervisor

Windows Architecture – After VBS
Normal Mode
(VTL0)
User Mode(Ring 3)

Kernel Mode
(Ring 0)Hypervisor(Ring -1)

Process A

Secure Mode(VTL1)

SecureProcess A

Process B

KernelSecureProcess B

Secure Kernel

Hypervisor

VBS Remote Disablement Protection
via UEFI Locks
Boot service UEFI variable isused as configuration source instead ofWindows Registry

Registry Key
VbsPolicy

IgnoredWinload.efi

Used

NV|BS UEFI Variable
VbsPolicy

VBS Remote Disablement
Protection via UEFI Locks
Disabling UEFI lock protected feature requires loading a dedicated EFI
application that requires physical approval to clear the UEFI lock

SecConfig.efiAsk user to physicallyapprove disablement

Clear lock

NV|BS UEFI Variable
VbsPolicy

VBS Remote Disablement
Protection via UEFI Locks
What will happen if we invalidate VBS files?
How will VBS react?

SecureKernel.exe

Hvix64.exe

VBS Remote Disablement Protection
via UEFI Locks
Windows boots normally, abandoning VBS
Even when enforced with UEFI locks!

Validate
SecureKernel.exe
Winload.efi

Validation fails

SecureKernel.exe

Boot normally

Demo #2 –Chaining It All Together
What are wegoing to see?

Credential extraction
against the mostrestrictive settings

Settings

How will it happen?

PPL enabled for LSASSwith UEFI lock

PPL bypass by reverting
the PPLFault patch

Credential Guard
enabled withUEFI lock

Credential Guard
disablement bypassing
UEFI lock

Windows Defender upand running

Turning Windows
Defender unfunctional

Demo #2 –What If only Credential Guard Is Bypassed?
LSASS can not be dumped

Demo #2 –What If only PPL Is Bypassed?
Credentials are encryptedDemo #2

VBS Security Boundaries

Security Boundaries:

VTL0 → VTL1
RING3/0 → RING -1

Attacker
startingpoint

User Mode(Ring 3)

Kernel Mode
(Ring 0)Hypervisor(Ring -1)

Normal Mode
(VTL0)
Process A

Secure Mode
(VTL1)

SecureProcess A

Process B

KernelSecureProcess B

Secure Kernel

Hypervisor

VBS Downgrades Goals
Understand if downgrade mitigation exists in thevirtualization stack components
Aim to downgrade to vulnerable code

Major downgrade without vulnerable code is still avulnerability

VBS Target – Isolated User Mode
Attacker
startingpoint

User Mode(Ring 3)

Kernel Mode
(Ring 0)Hypervisor(Ring -1)

Normal Mode
(VTL0)
Process A

Secure Mode
(VTL1)

SecureProcess A

Process B

KernelSecureProcess B

Secure Kernel

Hypervisor

Targeting Credential Guard
Isolated User Mode Process
Implemented in Ring3-VTL1 as an Isolated User
Mode process LsaIso.exe
LsaIso.exe contains secrets instead of the original
Lsass.exe
Lsass.exe proxy authentication through LsaIso.exe

Bringing CVE-2022-34709 Back To Life – Credential
Guard Elevation of Privilege
Vulnerable module is KerbClientShared.dll (10.0.22000.856)
Downgrading KernClientShared.dll to its vulnerable version worked!

Crossed security boundary is Ring3-VTL0 to Ring3-VTL1

KerbClientShared.dll

KerbClientShared.dll

WindowsUpdate

VBS Target – Secure Kernel
Attacker
startingpointUser Mode(Ring 3)

Kernel Mode(Ring 0)

Hypervisor(Ring -1)

Normal Mode(VTL0)

Secure Mode(VTL1)
SecureProcess A

Process B

Process A

KernelSecureProcess B

Secure Kernel

Hypervisor

Secure Kernel
SecureKernel.exe serves as the kernel for
Secure Mode (VTL1)
Implements security features such as HVCI,HyperGuard and more.

Bringing CVE-2021-27090 Back To Life – SecureKernel Elevation of Privilege
Vulnerable module is SecureKernel.exe (10.0.19041.207)
Downgrading SecureKernel.exe with some of its dependencies
such as SKCI.dll and CI.dll worked!

Crossed security boundary is Ring3-VTL0 to Ring0-VTL1

SecureKernel.exe

SecureKernel.exe

WindowsUpdate

VBS Target – Hyper-V’s Hypervisor
Attacker
starting
point

User Mode(Ring 3)

Kernel Mode
(Ring 0)Hypervisor(Ring -1)

Normal Mode
(VTL0)
Process A

Secure Mode(VTL1)
SecureProcess A

Process B

KernelSecureProcess B

Secure KernelHypervisor

Hyper-V Hypervisor
The Hyper-V hypervisor isHvix64.exe (Intel) or Hvax64.exe (AMD)The hypervisor is a standalone micro-kernel – valuabletarget for downgradeDowngrading the Hyper-V Hypervisor
to a two-year-old hypervisor
Many Hyper-V Elevation of Privileges have been found in the last two years
Microsoft does not share the vulnerable component in the Hyper-V stackI decided to go two years backward (10.0.22000.282) to prove the vulnerability
Downgrading the hypervisor with its loader HvLoader.dll worked!

Crossed security boundary is Ring3-VTL0 to Ring -1

Hvix64.exe

Hvix64.exeWindowsUpdate

Demo #3

Downgrade Attacks Implications
Attacker
startingpoint

User Mode(Ring 3)

Kernel Mode(Ring 0)

Hypervisor(Ring -1)

Normal Mode(VTL0)
Process A

Secure Mode(VTL1)
SecureProcess A

Process B

KernelSecureProcess B

Secure Kernel

Hypervisor

W I N D O W S D O W N D AT E

Windows Update
Restoration
Vulnerability

It All Started With Windows.old
Windows Quality Updates saves the old operating system in
C:\Windows.old for restoration purposes

C:\Windows.old

old Windows OS

Can Windows.old contents
be tampered with?
Access lists are copied from the old OS
It is impossible to temper with files that could not be previously
tampered with

Unprivileged Attacker

C:\Windows.old

Can not access old files

old Windows OS

Can Windows.old betampered with?
Unprivileged users have full accessto C:\Windows.old itself!

Unprivileged Attacker

C:\Windows.old

Full access

old Windows OS

Exploitation Strategy
Attacker can rename C:\Windows.old and re-create
an attacker-controlled Windows.old
As a result, the attacker-controlled OS is used in case of update restoration!
1. RenameWindows.old

Unprivileged Attacker

C:\Old-Windows.old

old Windows OSC:\Windows.oldAttacker Windows OS

2. Create attacker
controlledWindows.old

W I N D O W S D O W N D AT E

Closing Remarks

Responsible Disclosure and CVE
We responsibly disclosed all the research findings toMicrosoft in February 2024
Microsoft issued CVE-2024-21302

Microsoft’s Official Response
We appreciate the work of SafeBreach in identifying andresponsibly reporting this vulnerability through acoordinated vulnerability disclosure. We are actively
developing mitigations to protect against these risks while
following an extensive process involving a thoroughinvestigation, update development across all affectedversions, and compatibility testing, to ensure maximized
customer protection with minimized operational disruption.

Next Steps
Are there additional Windows features
vulnerable to downgrade attacks?
Linux Virtualization-Based Security (LVBS) wasintroduced, does the same design issues exist in theLinux implementation?
Are other operating systems such as Linux or MacOS
vulnerable to downgrade attacks?

Takeaways

Awareness and mitigations
against OS downgrade
attacks

Takeaways

Design must be regarded asa relevant attack surface

Takeaways

Thoroughly examine andexpand in-the-wild attacksCredits
James Forshaw

CVE-2022-34709@tiraniddo

Saar Amar

CVE-2021-27090@AmarSaar

Gabriel Landau

PPLFault@GabrielLandau

Valentina Palmiotti

Ruben Boonen@chompie1337@FuzzySec

Benjamin Delphi@gentilkiwi

CVE-2023-21768 Exploit

Mimikatz

Thank You!
@_0xDeku
linkedin.com/in/alonleviev
alon.leviev@safebreach.com